Amazon Linux 2 : spice (ALAS-2026-4030)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4030 advisory. A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPI...

Fedora 43 : perl-Text-CSV_XS (2026-39d5c46c12)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-39d5c46c12 advisory. Current upstream release, with several security fixes. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 44 : dotnet10.0 (2026-c8cb08de43)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8cb08de43 advisory. Update to .NET SDK 10.0.113 and Runtime 10.0.13 Fixes:...

openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:22151-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22151-1 advisory. This update for php8 fixes the following issue: Update to php 8.4.27: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143714)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143714 advisory. The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2026-4040)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.21.0.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4040 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October whi...

Linux Distros Unpatched Vulnerability : CVE-2026-109411

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat function. An authenticated user can bypass access controls to read or...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-133)

The version of kernel installed on the remote host is prior to 5.4.302-229.501. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-133 advisory. In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition...

Rocky Linux 10.2 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_80674)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680674 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts componen...

Linux Distros Unpatched Vulnerability : CVE-2026-115776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains...

Rocky Linux 9 [CIQ] Security Update: ca-certificates (crlsa-2026_88459)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202688459 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Fedora 44 : openssh (2026-a2ed02274a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a2ed02274a advisory. Fix CVE-2026-106585: Denial of service via oversized decompressed packets Tenable has extracted the preceding description block directly from the Fedora...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-119)

The version of kernel installed on the remote host is prior to 5.15.222-158.255. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-119 advisory. In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate...

MiracleLinux 8 : xorg-x11-server-Xwayland-21.1.3-20.el8_10.4 (AXSA:2026-2137:09)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2137:09 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server:...

Linux Distros Unpatched Vulnerability : CVE-2026-110264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2026-026)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0512.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2026-026 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of...

Amazon Linux 2 : wireshark (ALAS-2026-4006)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4006 advisory. SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-95389 Heap buffer...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_88229)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688229 advisory. httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer...

Linux Distros Unpatched Vulnerability : CVE-2026-39902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote,...

Amazon Linux 2 : alsa-lib (ALAS-2026-4041)

The version of alsa-lib installed on the remote host is prior to 1.1.4.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4041 advisory. alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte...

Linux Distros Unpatched Vulnerability : CVE-2026-89078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain...

Linux Distros Unpatched Vulnerability : CVE-2026-16762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the...

Linux Distros Unpatched Vulnerability : CVE-2026-116014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - open62541 1.5.0 before 1.5.7 contains an integer overflow in UADataTypefromStructureDescription that wraps the 16-bit memSize field for large custom structure...

Linux Distros Unpatched Vulnerability : CVE-2026-113877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolat...

Linux Distros Unpatched Vulnerability : CVE-2026-115580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry...

Amazon Linux 2 : nginx (ALASNGINX1-2026-017)

The version of nginx installed on the remote host is prior to 1.30.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-017 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143722)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143722 advisory. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-143711)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143711 advisory. internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have...

Rocky Linux 10.2 [CIQ] Security Update: ca-certificates (crlsa-2026_88455)

The Rocky Linux 10.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202688455 advisory. ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-114406 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: postgresql18-pgvector / postgresql18-pgvector-debuginfo / etc (crlsa-2026_88360)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202688360 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Fedora 44 : dotnet9.0 (2026-6dc45f0579)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6dc45f0579 advisory. Update to .NET SDK 9.0.122 and Runtime 9.0.21 Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_80694)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680694 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts component...

Amazon Linux 2 : ghostscript (ALAS-2026-4034)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4034 advisory. A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the...

Amazon Linux 2 : gstreamer-plugins-good (ALAS-2026-4023)

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4023 advisory. A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur...

Fedora 44 : btrfs-backup-ng (2026-d5ef07277c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d5ef07277c advisory. Update to 0.9.20. This replaces the 0.9.19 update before it reached testing. It carries the 0.9.17 security fix GHSA-5xvm-66c9-p5ph, the 0.9.18 fix for...

CentOS Linux 8.4 [TuxCare] Security Update: brotli / brotli-devel / python3-brotli (CENTOS8.4:CLSA-2026:1792827285)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792827285 advisory. - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows ...

Linux Distros Unpatched Vulnerability : CVE-2026-93577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain...

Linux Distros Unpatched Vulnerability : CVE-2026-115722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value typ...

Amazon Linux 2 : firefox (ALASFIREFOX-2026-067)

The version of firefox installed on the remote host is prior to 153.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-067 advisory. Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefo...

CentOS Linux 8.5 [TuxCare] Security Update: brotli / brotli-devel / python3-brotli (CENTOS8.5:CLSA-2026:1792827041)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792827041 advisory. - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows ...

MiracleLinux 9 : php-8.0.30-8.el9_8.1 (AXSA:2026-2143:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2143:05 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption...

Fedora 44 : pgbouncer (2026-20b7549bd1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-20b7549bd1 advisory. Update to 1.26.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Amazon Linux 2 : aspell (ALAS-2026-4022)

The version of aspell installed on the remote host is prior to 0.60.6.1-22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4022 advisory. A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service DoS by...

Amazon Linux 2 : gstreamer1-plugins-good (ALAS-2026-4024)

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4024 advisory. A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur wh...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2026-125)

The version of containerd installed on the remote host is prior to 2.3.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-125 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-111756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects...

Amazon Linux 2 : golang (ALAS-2026-4005)

The version of golang installed on the remote host is prior to 1.26.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4005 advisory. When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2026-129)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-129 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate...

Amazon Linux 2 : runc (ALASDOCKER-2026-154)

The version of runc installed on the remote host is prior to 1.4.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-154 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority C...

Amazon Linux 2 : runfinch-finch (ALASDOCKER-2026-151)

The version of runfinch-finch installed on the remote host is prior to 1.19.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-151 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the...